Overview

overview

10

Static

static

3

2024-03-28...ia.exe

windows7-x64

10

2024-03-28...ia.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-03-28_df5f16a2dfa6688cea45dc22cbe669ca_karagany_mafia

  • Size

    250KB

  • Sample

    240328-kzhytsha2t

  • MD5

    df5f16a2dfa6688cea45dc22cbe669ca

  • SHA1

    f4af36b029369e4f84c8887df28a0b88636c1492

  • SHA256

    abcc491345f032a6f691f881a671c08ab6e9556ed6d2063c7d92182ef43badbf

  • SHA512

    0888e954deb1d5bb49bbdfcd47b313666fee54fd22de40dd2f1c4cabf059426c0aa8207596e338c3df92f0befb56a48accf494ffac63e57180c6b2adb481b4f8

  • SSDEEP

    6144:s+YrOIBjaklexBgiJ8sTSIkIpxIp8mDtfPBRwasxXq:EOCjaklYgVIpxIhDtR

Score
10/10
gandcrabbackdoorpersistenceransomware

Malware Config

Targets

    • Target

      2024-03-28_df5f16a2dfa6688cea45dc22cbe669ca_karagany_mafia

    • Size

      250KB

    • MD5

      df5f16a2dfa6688cea45dc22cbe669ca

    • SHA1

      f4af36b029369e4f84c8887df28a0b88636c1492

    • SHA256

      abcc491345f032a6f691f881a671c08ab6e9556ed6d2063c7d92182ef43badbf

    • SHA512

      0888e954deb1d5bb49bbdfcd47b313666fee54fd22de40dd2f1c4cabf059426c0aa8207596e338c3df92f0befb56a48accf494ffac63e57180c6b2adb481b4f8

    • SSDEEP

      6144:s+YrOIBjaklexBgiJ8sTSIkIpxIp8mDtfPBRwasxXq:EOCjaklYgVIpxIhDtR

    Score
    10/10
    gandcrabbackdoorpersistenceransomware

    • GandCrab payload

    • Gandcrab

      Gandcrab is a Trojan horse that encrypts files on a computer.

      ransomwarebackdoorgandcrab

    • Detects Reflective DLL injection artifacts

    • Detects ransomware indicator

    • Gandcrab Payload

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks